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(57)Abstract: ■ .. J'J 

PROBLEM TO BE SOLVED: To enable a system to * 
handle optional data, to handle optional communication 
between networks, to facilitate coping with the increase 
in number of protocols and to handle arbitrary protocols. 



SOLUTION: This network illegal communication analysis 
system 50 analyzes illegal communication on a network, 
where communication is conducted between information 
communication stations according to a hierarchical 
protocol. The system 50 consists of a data collection 
section 55 that receives a packet PT transmitted on the 
network 3, a data generating section 56 that sets a 
parameter of a hierarchical module in response to the 
hierarchical protocol, based on information in a 
configuration file read in advance and processes a 
packet from the data collection section with each 
hierarchical module to generate analysis data DT, and a 
data analysis section 57 that discriminates the response 
of illegal commutation in the analysis data DT, based on 
the content described on the file. 
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S*\ k u ^ W«SIS|5 6 1 , . ZMft 2 -ft -S ©*>S*\ 

5 7 tcjg-r *>5*>©/^ ^ y - # $ nrt > -s© 
r\ -e-oA^^-^c^jcge^rMa^ntf-rs (s 

15). 

[ 0 0 5 5 ] 0!l*.«, n>7 ^l/-J/ 3 >7r -Ol/© 
W$g©fg^f c J: otS;^^-* 3&S8S3E 3 tir S £ T 
30 Si, klxW-^-t^^-^e l k r*», ±B©H'^* 
^ * -;l/j6^a Lfcil&S©-? 1 - $^kU-ft7^M6 
l kA ^a®$-tffc©^ (S 1 5 1 ; YES) , 
f?:S«M-rS^(c« ( S 1 5 2 ; YE S ) . ^ v V 

rzmmb-cunmb (s 1 5 3) . r^y*--: ^a> 

B#fi-C©7-'- * ft * T?©S«»3^ST L- ft l^^tc tt 
(S 1 5 4 ; NO) , ynVsJ^Va-frG 1 „ 

So -eUT, 'X<Drt*rv Y^m^-TMs (S 1 2) . 
[0 05 6] Sfc. ;^7r*tfflL-t»i^L (S 1 

5 3), S#IS^7 L,fcJ«^ ( S 1 5 4 ; YE S ) Ct 
40 «k b-i'-t'W^^gP6 l kll ©-'t- ? '7 T {C'r t "^3&5S^.r 

64iri^So C©»^**l>tt'? s -3f*»»tlLft(r>» 

^ <s i 5 2 ; no) mmmbtc^-zz^-z 

ffiffi$H5 7(C?g-r^-r 5-Y^(Cft-ofci^(C (SI 5 
5; YES), kWirffliiggP6 l„©/<» 7 tCC^ 

^.rofc^-ir^-^jBwaps 7Kflrr <s 1 5 

6) o 7 r -^|?WgP5 7tC^3ft(,^W'5>^{c 

ftofciCST? (S 1 55 ; NO) . cnJ:0±flH©J» 
© H'+^r^^ -;KCf"- ^^rig-To 
[0 0 5 7 ] cnfCjcO, kl-ffty a -*6 1 k <t 
50 0 _hB© U A -V^V ^ -)l>-€!gm 3 tltdfe^ i8Km 



11 

-rj^fciwfigsftr <S2 3) . frmztitcr-* t 

LX Trac J ilO 9 4 a#^-£fS?#rgl55 7 CC 

[0 0 5 8] «-L©ASH* 1 *>r y t-micmK)&'?C £ 
fC<tO (S 1 3~S 1 6) . h^-fi-rCDT 5 -^ 

^{i©^ v f p t t*, h 8 {c^-r«t 5 tcBamssn 

(S23) , ri amj it,^f-$94bi l r a cj 
il^f-^94di, r r acj il^f-*94a 
i. Tker.J i l>5 7*-£ 9 4 c LHCft% ^tifcf- £ 
Sfcfc. WMSStn: (S2 4K ri am a c 
racker. J £l>5 T V V V—ls a > U i'-C©5c©f i — 
£9 5(c£ft£ 0 

[0 05 9] Tft©«©IWi^5^~ll/#i_hiB©J: 5 

[0 06 0] Nl/-ft7^^6 1, r». ±ifiil5J« 
-^DTiUTiP-^BWrBPS 7 KjKr (S16). 

[0061] sfc, c©^p-?-f- h^fiffl-rti«. 
wm<Dmm<D7 4>\,z sss&r z> c <t k g «^©a^R 

®?7^> ^©^IET ^ -fe X ^pJ^Ftc^-C # & „ 
[0 06 2] f"aJ»M5 7m TZfVir-: i/a> 

-v a > -7 r -y ^rjgss n/crt^»c 7 s - itmsaR 

5 6 6 ©#8? 7 s - 3? D T 5C^ iE3&s»* ITt,^ 
Lri>-5>„ C©T^"';^r-^3>T^-7^1f 5 7 0©flj 

5&BM9 0 OiLrgmStlS. 
[0 06 3 ] CCt?, r^';-5r-ix3>r^-7^1f5 7 

smrrsj^Kt/cos. fit., cft6©*Ha#atcPR 

[0 064] ( i ) ffigLtVS^P h=iATr£©«S9 
^II ; £T^"'J^->'3>T^-7'rif5 7 0ffl©3>7 

[0 06 5 ] (11) H2*a»;^^**«-rSfc»Kl« 
ir-: iya>Ti' : 7^1f 5 7 0ffl©3>7 * ^U-i/ a > 
fb&s* -5 fcB#*r. *©ji«l35PiEa; *>©t** i^iJKff 

[0 0 6 6] Jh££Lft:*9 h «7 - ^IE8?#r>X -r A 5 



(7) ftM¥ 1 0-3 1 3 34 1 

12 

[0 06 7] ( 1 ) TCP^O I-ri;U©^-$->X#-5§ 
**HWU «©-fef ^a>*»«b«Klsr**^ h©7 

[0068] (2) SMTP^HhaACDEBUGa 

[0 06 9] (3) M I ME^ffiotlfS^X l-iD-fe^ 

10 [0 07 0] (4) m^-Jb-^-^-X^iJcIS^* 
x h©*HlflB#&iHitT:*«{cja!i)-3tf v ^^^-^ 

[0 07 1 ] ( 5 ) te"lnef7*P h :=UUT?, root.cjuest^ 

Jfl'JU n^>^SCi„ 
[0 07 2] (6) TFTF/P hn^fflUt. A*? — 

i„ 

[0 07 3] J!SLh©J: 5«c«fiSS*ifc3^aB|5*©* ? 
20 F-7-^IEji¥W^;*^A5 0tc«£*i«. %©J:9ftfd 

[0074] ( 1 ) T:/';^-—>a>Ji£-C©-fc^>a 
XDWmmZft 5C±J)1>-CZ, ^JEMffiZlS C ft 5 %<<C 

^ - e> a >H $ -c© -fe ^ ^ a > ©WtlS^tf -? T I © 

5»ap^Ki6^-r*©r. cc^-^gp^D^iE^wr 

3 C i tc J: «j »*©Sl ^jQBWStr 5 C i sWr » 5 . 
[0 07 5] ( 2 ) Ji«<WS^tt*i>a-jWbKJ: D . 

JV8 0 0 ©J; 5 (c^f^Mfc-e^ ^tfl©* ?f--7 
-^iE)S?ff->^fA5 0tt3>7 ^ tfV-lsals-y r 

■fji-tmMicmiz co^Mzmm br^iE©^tf^ 

7-/ ^lx-^a>7T-l';l/Ra f 7 s -^^g|55 6©if/c 

a-;l/©**Sirr-5C:<btc«fc«3*t'iS-r6Ci*s , r* 
S„ C©/cfe. 7^-^^1955 6 *ff/c{clB^nfc 7" 

[0 07 6 ] ( 3 ) f-"- ^»Wgp-e©^FiE«?W»=i > 7 
50 m>ti*©"C. fffc&«S©^FiE©^*3>7 -Y 
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[0 07 7 ] (4) Mffi&*y F7-i>3i0a*^ 
•a-tCctO, ffiS©aft£IR^x.&<£5(C&ofc 0 w*. 
tf, LAN l©X:r— >3>^$1-g]5*;> f-"7-^7#i« 

[0 07 8] (5) «^7f-7-^3itr*XF 

[0 07 9] &*s. ±^©HSfe^!S«*^K©fiTtt>5:|| 
St©— ffl-Vte$>2>&£.ti< l cm'%.2in?> &©"?»& < 

0 1 0 ic^T «£ 5 (C. ^h^-i^IE 
h y-fj>%~-7 x^^SXTMl©* v 

•^•7-^7i ©ia©a«tti&-r* * h •? - p^jemk 

[0 08 0] 0 1 1 K:^-TJ;a(c. * v V V-Z> 

-^MWgP5 7#>?>7"-£iKJISB5 5NtfWil6£*7 ^ 
tt, ^-^ fM$ 5 6 so* t 1 - * ftiwas 5 7 <DM=wm ft 

mm*mmvxi>z> a c©*£\ f : -^»wai35 7©i? 
-> 3 >^*x h#^#^r£fc*§i^\ ^©affi(c-x>r 

T. * s> h «7- £ T©^iE© L AN 1 -"-©{ftA^ 

[0 08 1 ] 3 6tC 4 11 2 tiCTp-fj: 5 fc, 7 s - 

U.. -, 6 1„4#t47^^y>yjl!!Ig|i5 8 
@1«jS©W^W#S§3B6 1 1B , 6 1 kB . -, 
6 1 N .^Wf-SSmm^aa55 9 i^Iifcfe©K1"S 
Ci^-c#5 0 C©*§£\ 7*-£ffr£SB5 6Ttt 

5 9K*5^r#u^i'icour©Wt'®MS^f ^„ c 



C8) 1 0-3 1 3 34 1 
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[0 08 2] ±aiL,/cSHJS^-C*{** » h 7- 

^JEPW^>X^A5 0{*H^L/^t^>f^-^->X 
7^A#>«E>1iJi£$*l-5fe©£ L"CI,>-3#\ C*ifC«|5g6ft 
fct». #|R«\ -bj&L/c* 7 h V-f^iEMVrt&OlT 

- z mtkjom t?~% fB&rg <t * jhwxs ± % 3 
> t* * - # {cuff 3 •£ -sfcab© a ? ^ alibis l/c c 

ast o utettsssw* i/T«affl 3 > tr » - * *fan 

10 -r^ci^-c^s, 

[0083] C Cr©^P ^ ^ffcfl^CW:. ff#g 

a#*tf5J:5K«!Rsnfc*9 h<7-^-h-ces$n 
rus^-s--? H^m^tfT^-^JDrnxfi^swrr-Sf 1 

ft,-*^ - ;!/© A5>^ - $ ^*Sc*jA^'*st > 
a-^-C?^^ 'J>^IW^ h©ffl#{fc3ftfcf* 

■5 5*- 4r WW^JIgi * 3 > tf a. - ^ icmfZ i±?>tc!sb(D 

fe©r*-5o 

[0 084] ±^LfcHife^Ti*^-£JKJII 
g<h 7 s - $f?JSI« i 5 s - ZMffiJM t *iaffl=J > far * 

30 g**ffl©3> t * - dr*6^**fefi Ufc^gtC*j|tf§ 

IE6n-rcn6©Xg*^-*->^SKR:||ffSl±*J: 

^fcira^. t>rft©»£*K f-^i^EiSicfc 
*7c©^fe(cfi«^-r ^ c 4 tc «*: 0 aw??*- ir *fftsr 

[0 08 5 ] 

[#BBj©Sfj#] «±mBJLfcj;5tc, it^ffil©»Hj© 

- ^mSXfMtCfc^Tx- $JRKLES*>6©/'C^ 9 h * 
g-PgBfk*^ -f y > ^ LT ;^ t» h ©sffl 

^{t^nfcT'- **7c©mffiK:Wfeil-r« C itc <£ 0 
*ff*-i'*flBSL/r. 7=- ZMVrJIW-Cter-Z t LX 
50 ^»©*)SB«»«©»PW7""^*'¥?tff*tm<!;-rSC<b 
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[008 6] mc* v V ^-^(cfc^^iEtt^-^gP 

USA*-, h-cjs^-^aJ^jftiffldfbStirtiSeDt?. 
C©f- £^(C^E##iS£Lfcfr£^T£©«:E»£ 

*Lfc*>i&iFS{C#lJ^T-5 C£&X% 
[0087] i»*3S2E«©»M©* vW-~>? 

7 1 - £iR3lgp#> 6©^ 9 h *#ffi®{fc*i? J2. 7 
-f ;u ^ U >^LW * h ©&B5Hfc£ titer"- Z £tu© 

[008 8] ?6K, «*S3iatg©^©iai^<*(C 
*©^ ^-^J^Jiicte^T, ^"^iR^JB*^ 

£#rSS. C©fc«\ 7*-£S|S#K:#&£L 
[0089] Ltc& -oX, m$3M 1 *> 6 3 ©^-TftjWc 
S« 

[0 09 0 ] (1) 77'';^^3>ifC!)tttOli 
T?©-tr y ^ a >©ffl» «*ff 5 C £ &~C t . ^FIEM7t£ 
*J C ft 5 i r> T fc>*>9 7 s - £ £BX o a* S «fc "5 

icfto/c 0 -r&frfe, ^i-hy-nro^yft© 

#5. CftJCfcO. r-*#©*IE©W*S*?§®K:3pJje 

<tt7 t -*fip»fc«^-r«©r. c©7*-*ai#©>fiE 

[0 09 1 ] ( 2 ) Itt®^atya-JWtKJ:5. 
S0K©«R©:/p h a *«t 5 tc & ofc. Tftt? 
h 7-:7©:7*P H3;H*05tC7r;"r|SgJl{tr&7 :r 



C9) 1 0-3 1 3 34 1 
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>7 7 -f Jl-SO'-r- *fB£li£g 1/ < *f&«3fflf© 
mtct^U h3;l^#/£T3Jt£tI3T3-§l$©Wi* 

io *st?#-S„ 

[0092] ( 3 ) 7*-*JSWlg?gL < 
gfSr©^IE)S?tfTt*3>:7 ^ > 3 >7 r >f JUcBBifi 

Lfc«^rjS{cs^»rfrton*©-c. tffcfta®©^ 

jE©#&±&3>7.f ^lx-^3>7T-f^©iaili^M 

^©^-c^-^wi^st, < ttf-^fwcv? 
h 1 7 IMtlt 5 c i a < tffit ^ C i 

So 

[0 09 3 ] (4) tV-Ptomfr&frU 

fc<fcf3, e«©iiM i £Koa*sj:5K&ofc. m 

S*B^«c» ffiK©3SSM5ci36M5tiic^»r^iE»Wf* 

[0 0 9 4] (5) Mffi&*-y h7-^tl,t*Xl* 
fcSLftLTUS©^ *X HR©i«»{Cfea«{c*f|£:T 

[0ffl©lS^ftiJiK] 

[an *isw©* » h ^jEMtittmimmzti 

tc* v Y V-~t> ttMKisZ<r^<Dmm<DBm&fjk-3- 7 
30 [H2 ] * 5» h y-?^fjEffl#xlsX7-J*t* v V *J-i> 

[03 ] * v v y-?^m^^j*<DmM<Dm&<D 

[04] i5iiut©^-c^ffl-r-S3>7^ yu— > 3 > 
"j ~r a fr<Dm*fFr?mmmx*> ?> . 

[05 ] ra^J6©^*K^n h ^©HMftOflteSMU 
T-Sfc^©0r5>-& <> 

[06 ] R^te©j|g«ji©«rfp%attij8-rsfca>©7 p-?- 

40 [07] ISI3tEK©^»©»fP*ttW-rSft:8&©HT* 

[08] Bne»©ji5»©»f^*ttw-rsfc8E)©iar* 

So 

[09] mmj&oBm-c&m l idim zm-rm-e*, 5 . 

[B10] -7 - ^T-iEStf f A©i©Hii 

[011]** h*7"^iEfStfT^X7 u A©SIJ©|Ufi» 

[012] *s> h>7-^iEi?W^X-rA©$e>tcffe© 

50 mm&m&tjkfju ? vmx&z,. 
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* 5 0 




1 LAN 


5 5 




3 mum** 


5 6 




7 mn^yhv-p 


* 5 7 





[HI ] 




562 



(11) 



1 0-3 1 3 34 1 




[02] 
3 

-tL. 



-52 



A 1 



I 



-53 6 
< 



r 

50 



[S3] 



p 



51 



PT 



^PTa 



-50 



[04] 




^ 500 




* 




# Filter for login Analyzer 

# 


, 4 

4 


filterset { 


1 


physical - { ether: * <-> aa:bb:cc :jck :yy : zz \ 
network - ( ip: * <-> 202.2S.95.68 } 




transport - { tcp: * <-> 23 } 

analyzer = { login-A login. conf -log login* log 

> 


-dump login. dump) 



[05] 



800 



-807 
-806 
.805 



^804 
— -803 

^,802 

^801 



WfHPF 1 0-3 1 3 34 1 



me] 



C STAR TS 

I =»^:7^i — ^g^r^oflfefri&frl Sll 



— ™- — 



No 




I Wffi^Mrt- 1^~S156 





■ 

■ 


^S16 


1 
1 







ci3) - nm^ io-3i 3 34 i 



[H7] 



S21— £ 



TGtf^-* I— --IT 

1 - 



am a cracker. 



nz 



94b 



94d 94a 



S22— 



I am 


1 a c | rac 


ker. | 


91b 92b 93b 
/91af /92af ^3a f 








rac J 




mm*.™ 


re#i 


I am f 




D 






ker. ^ 


MH 


D 




K»2 


a c % 


91d y 
91c 


92d 793d ^ 
92c 93c 





— K 



90a 

90b 
90c 

90d 



[08] 



S23— 



mm 



J. 




d ' J 92d /9 



| as#2 



ker. J- 1 94c 
1 ^ - ■ 



94d 



93c 



S2< 



I 



| I am 1 1 a c 1 1 rac 1 1 ker. | 



9^b 94d 94a 



94c 



cracker. 



[010] 




Z 



50 



f 




r 



ftfflW- 1 0-3 1 334 1 



[19] 



900 



Cracking Data contents 



Date : Dec 26 13:28:00 1996 

Server Address : 202.26.95.68:23 

Client Address : 202.26.95.69:1024 

Defhost Name : host! 

Login Times : Threshold User = 0 Threshold System 

Easy Password Used : NO 



Command Details 



S : Welcome to mail.nal.ga.jp <ttyp4) 

S : 

S r login: 

C : root 

S : Password: 

C : raotS 

S : Login incorrect 

S : login: 

C : root 

S : Password: 

C : root 



[ill] 
A 



551 ! if 



50 



I 



56 



r - 



57 



i- 



ftmW- 1 0-3 1 3 34 1 



[112] 
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i: 




551 
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J ■ , - •- 


r 611A ! 


1 n - 5 - - ^ > -_ : 


> w •> ; -. .-.^ - 
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UlkA j 




-61NA ^-56 






^59 ; 



611B 



6lkB 



61NB 




i 

1^57 



62a 62b 62c 



562 



